PT-2021-5828 · Exiftool+5 · Exiftool+5
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
ExifTool versions 7.44 and up
Description
The issue is related to improper neutralization of user data in the DjVu file format, allowing arbitrary code execution when parsing malicious images. This could enable a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability was exploited in real-world incidents, including a case where researchers found that VirusTotal could be used to gain remote code execution on certain sandbox machines due to the use of an outdated version of ExifTool. The vulnerability is considered high-risk, with a CVSS score of 7.8.
Recommendations
For ExifTool versions 7.44 and up, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the processing of DjVu files until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the DjVu file format in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Special Elements Injection
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Exiftool
Linuxmint
Suse
Ubuntu